PT-2022-17134 · Jenkins · Jenkins Autonomiq Plugin+1

Published 2022-02-15 · Updated 2023-11-03 · CVE-2022-25194

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins autonomiq Plugin versions 1.15 and earlier

Description A cross-site request forgery (CSRF) vulnerability exists due to the lack of permission checks in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. The HTTP endpoint is also vulnerable because it does not require POST requests.

Recommendations For Jenkins autonomiq Plugin versions 1.15 and earlier, consider disabling the vulnerable HTTP endpoint until a patch is available. Restrict access to the endpoint to minimize the risk of exploitation. Avoid using the username and password variables in the affected endpoint until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-25194

GHSA-G5WH-FW4M-2V28

Affected Products

Jenkins

Jenkins Autonomiq Plugin

References · 6

• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2545 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5wh-fw4m-2v28 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25194 · Security Note
• https://github.com/jenkinsci/autonomiq-plugin/commit/e06b1ff67664a90819c9561bbc12f4c6e593d1dc · Note
• https://github.com/jenkinsci/autonomiq-plugin · Note